Mixed NetFlow version collection

[slobodanL]

Hi all,

Can someone tell me is it possible to collect flows from exporters with a different NetFlow versions (in my case I have exporters with Netflow version 5 and version 9, and I am getting flows from sources configured with version 5). So far I didn't get any flows from exporters with version 9. Is there a configuration option which enables/disables Netflow version.

Thank you

[jamegill]

Hi slobodan.lakic@telegroup.ba ,

There is no problem with collecting flow of different versions from exporters.   In the Stealthwatch Desktop Client, the NetFlow Collection Status table includes a column for "Flow Types" and will show you the version received from the exporter; NetFlow v9, NetFlow v5, IPFIX, etc.

If you're having problems with the v9 configuration, make sure you are collecting all of the requisite datapoints:

    •    Source IP

    •    Destination IP

    •    Source Port

    •    Destination Port

    •    IP Protocol

    •    Packet Count

    •    Byte Count

    •    Time first seen

    •    Time last seen

For reference, check the NetFlow Configuration Guide for your version of operating system.

--jg